From 2643a446d029aaa14e7b43d34d40ad6a4e4cad75 Mon Sep 17 00:00:00 2001
From: Lucas Winther <lucwin@ece.au.dk>
Date: Tue, 28 Jul 2026 08:22:01 +0200
Subject: [PATCH] Gitlab docker build issue fix.

---
 .gitlab-ci.yml | 28 ++++++++++++++++++++++------
 1 file changed, 22 insertions(+), 6 deletions(-)

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 7cea02a..31c76cb 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -24,17 +24,33 @@ build-image:
     - echo "$CI_REGISTRY_PASSWORD" | docker login -u "$CI_REGISTRY_USER" --password-stdin "$CI_REGISTRY"
   script:
     - docker build --pull -t "$IMAGE_SHA" .
-    # with-server-engine extends the runtime stage, so this build reuses every
-    # layer from the one above and only adds the python/faster-whisper layer.
-    - docker build --target with-server-engine -t "$IMAGE_SHA_FW" .
-    - docker push "$IMAGE_SHA"
-    - docker push "$IMAGE_SHA_FW"
-    # Only the default branch moves the :latest tags.
+    # Fully tag + push this image (including :latest) before building
+    # with-server-engine below. That build shares almost all layers with this
+    # one (it extends the runtime stage), and building a second image sharing
+    # content with an already-tagged one is a known containerd-image-store/
+    # buildx bug where the earlier tag's local reference can stop resolving
+    # ("tag does not exist" on push) — see moby/moby#52897 and
+    # docker/setup-buildx-action#116. Finishing all push/tag work on this
+    # image first closes that window.
     - |
       if [ "$CI_COMMIT_BRANCH" = "$CI_DEFAULT_BRANCH" ]; then
         docker tag "$IMAGE_SHA" "$IMAGE_LATEST"
+      fi
+    - docker push "$IMAGE_SHA"
+    - |
+      if [ "$CI_COMMIT_BRANCH" = "$CI_DEFAULT_BRANCH" ]; then
         docker push "$IMAGE_LATEST"
+      fi
+    # with-server-engine extends the runtime stage, so this build reuses every
+    # layer from the one above and only adds the python/faster-whisper layer.
+    - docker build --target with-server-engine -t "$IMAGE_SHA_FW" .
+    - |
+      if [ "$CI_COMMIT_BRANCH" = "$CI_DEFAULT_BRANCH" ]; then
         docker tag "$IMAGE_SHA_FW" "$IMAGE_LATEST_FW"
+      fi
+    - docker push "$IMAGE_SHA_FW"
+    - |
+      if [ "$CI_COMMIT_BRANCH" = "$CI_DEFAULT_BRANCH" ]; then
         docker push "$IMAGE_LATEST_FW"
       fi
   rules: